Persistent account access via weak passwords and tokens

Weak password and session-expiration flaws in Vikunja before 2.0.0 allow remote attackers to retain access to compromised accounts. The password-reset and password-change handlers failed to invoke the validator or apply its password-length constraint, while password changes left previously issued session tokens valid. An attacker must first guess or obtain valid credentials; an existing token then continues to authorize account access after the account owner changes the password.